fix：参考金值，研听，研值工程通用通用工程公共能力，重点对比网络请求、登录认证、状态管理、本地存储、WebView、推送、版本更新、一键登录、主题/UI 等模块，确定后续统一整改方案

lib/common/network/auth_interceptor.dart

@@ -2,10 +2,12 @@ import 'package:dio/dio.dart';
 
 import '../services/device_header_service.dart';
 import '../storage/secure_identity_storage.dart';
+import '../storage/preferences_storage.dart';
 import '../storage/storage_service.dart';
+import 'api_exception.dart';
 
 final _defaultIdentityStorage = SecureIdentityStorage(
-  StorageService.to.preferences,
+  PreferencesStorage(StorageService.to.preferences),
 );
 
 Future<void> saveJwt(String token) => _defaultIdentityStorage.saveJwt(token);
@@ -13,22 +15,51 @@ Future<void> clearJwt() => _defaultIdentityStorage.clearJwt();
 Future<String?> loadJwt() => _defaultIdentityStorage.readJwt();
 
 class AuthInterceptor extends Interceptor {
-  AuthInterceptor(this._identityStorage);
+  AuthInterceptor(this._sessionStorage, {required Uri backendOrigin})
+    : _backendOrigin = backendOrigin;
 
-  final SecureIdentityStorage _identityStorage;
+  final AuthSessionStorage _sessionStorage;
+  final Uri _backendOrigin;
 
   @override
   Future<void> onRequest(
     RequestOptions options,
     RequestInterceptorHandler handler,
   ) async {
+    if (!_sameOrigin(options.uri, _backendOrigin)) {
+      _stripSensitiveHeaders(options.headers);
+      handler.next(options);
+      return;
+    }
     await DeviceHeaderService.to.ensureInitialized();
     options.headers.addAll(DeviceHeaderService.to.commonHeaders());
     options.headers.addAll(DeviceHeaderService.to.platformIdentityHeaders());
-    final jwt = await _identityStorage.readJwt();
+    final jwt = _sessionStorage.accessToken ?? await _sessionStorage.restore();
     if (jwt != null && jwt.isNotEmpty) {
       options.headers['Authorization'] = 'Bearer $jwt';
     }
+    options.extra[authSessionGenerationExtra] = _sessionStorage.generation;
     handler.next(options);
   }
 }
+
+bool _sameOrigin(Uri request, Uri backend) =>
+    request.scheme.toLowerCase() == backend.scheme.toLowerCase() &&
+    request.host.toLowerCase() == backend.host.toLowerCase() &&
+    request.port == backend.port;
+
+void _stripSensitiveHeaders(Map<String, dynamic> headers) {
+  const sensitive = {
+    'authorization',
+    'x-device-id',
+    'user-devicetoken',
+    'user-android-id',
+    'user-android-oaid',
+    'user-android-imei',
+    'user-android-mac',
+    'user-ios-idfv',
+    'user-ios-idfa',
+    'user-ios-paid',
+  };
+  headers.removeWhere((key, _) => sensitive.contains(key.toLowerCase()));
+}